studio-feedback

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands via the Bash tool to retrieve basic system diagnostics (such as the operating system name and version) and to read the skill's own version from its configuration file. These operations are limited to non-sensitive project and environment data.
  • [DATA_EXFILTRATION]: The skill generates a GitHub URL containing diagnostic information as query parameters to pre-fill an issue form. Potential risks are mitigated by strict mandatory sanitization rules that strip PII, secrets, and credentials before the URL is constructed. Furthermore, the skill enforces a confirmation gate that displays the exact outbound data to the user, ensuring no data is sent to the vendor-owned GitHub repository without explicit consent.
  • [SAFE]: The skill incorporates explicit safety constraints, including forbidding automatic issue submission, prohibiting the collection of raw conversation history or project files, and preventing data transmission to any background telemetry infrastructure. It also includes specific instructions to safely handle URL execution on macOS to prevent shell command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 03:44 PM
Security Audit — agent-trust-hub — studio-feedback